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ABSTRACT -- NASA has embarked on a multiyear technology development effort to develop a safe and 
precise lunar landing capability. The Autonomous Landing and Hazard Avoidance Technology (ALHAT) 
Project is investigating a range of landing hazard detection methods while developing a hazard avoidance 
capability to best field test the proper set of relevant autonomous GNC technologies. Ultimately, the 
advancement of these technologies through the ALHAT Project will provide an ALHAT System capable of 
enabling next generation lunar lander vehicles to globally land precisely and safely regardless of lighting 
condition. This paper provides an overview of the ALHAT System and describes recent validation experiments 
that have advanced the highly capable GNC architecture. 

1. MOTIVATION 

A return to the lunar surface will require increased capability beyond that of the previous lunar landings. 
Longer stay times and a greater flexibility with regard to landing locations are among the many improvements 
planned for a next generation lunar lander vehicle (LLV). A descent and landing system that can land the 
vehicle more accurately than Apollo with a greater ability to detect and avoid hazards is essential to the 
development of a future lunar infrastructure and also for increasing the number of potentially accessible Lunar 
sortie locations. A modern descent and landing system should allow landings in more challenging terrain and 
provide more flexibility with regard to mission timing and lighting considerations, while maintaining safety as 
the top priority. Recent NASA lunar landing projects have addressed the need by applying terrain-relative 
navigation measurements to enhance global-scale precision, an onboard hazard detection system to select safe 
landing locations, and an Autonomous GNC (Guidance, Navigation, and Control) capability to process these 
measurements and safely direct the vehicle to a landing location. This next generation lunar landing system will 
enable safe and precise lunar landings without requiring lunar infrastructure in the form of navigation aids or a 
priori identified hazard- free landing locations. A safe landing capability is also being considered by NASA 
which uses onboard active sensing to detect hazards that are large enough to be a danger to the vehicle but too 
small to be detected from orbit a priori. Algorithms to interpret raw active sensor terrain data and generate 
hazard maps as well as identify safe sites and recalculate new trajectories to those sites are included as part of 
the envisioned NASA System. These improvements to descent and landing will help contribute to repeated safe 
and precise landings for a wide variety of terrain on the Moon [1]. 

The Apollo lunar landings stand as one of our nation’s greatest achievements and each of the missions signifies 
a hugely triumphant and successful engineering endeavor. In the end, all of the lunar surface missions were 
hugely successful because of incredible engineering, incredible piloting and maybe just a little bit of luck. 
Using recently obtained lunar imagery, Apollo surface pictures, and direct quotes from each landing crew 
member, a close look at each of the six landed Apollo missions is described and carefully depicts just how 
challenging each of the lunar landings were even under ideal lighting conditions and purposefully chosen 
relatively benign equatorial locales [2]. It is clear for this go around that NASA desires the LLV to land 
globally (not just equatorially) and desires the LLV to land under any lighting condition. As compared to 
Apollo, this is a significant change in expected lunar environment and greatly impacts overall mission 
objectives and design. 



Fig. 1: Apollo 15 Lunar Module Falcon at the Hadley-Apennine landing site with read pad in a crater 
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Given the uncertainty in the performance of passive or human based sensing systems when applied to safe site 
identification during low lighting conditions (see figure 1), an active sensor hazard detection method should be 
developed to quickly trade between cost maps that define the performance, cost, and risk at landing while safely 
avoiding hazards and minimizing divert fuel costs. Coupled with an on-board hazard detection system, the 
hazard detection method would provide a powerful means for safe redesignation of the LLV during the 
approach phase of the mission to better achieve the goals of the mission. A modern LLV can leverage state-of- 
the-art sensor hardware and software to enable landing at more challenging locations than Apollo. These 
technologies of benefit are being pursued with a modest investment through NASA’s ALHAT technology 
development program [3]. 


2. ALHAT PROJECT 

The ALHAT (Autonomous Landing and Hazard Avoidance Technology) Project is a NASA technology 
development project which is investigating a range of lunar landing hazard detection methods by developing 
reference GNC architectures, trajectories, trade study reports, and analysis software in an effort to pursue and 
field test the proper set of relevant technologies that are in need of technology advancement for lunar landing. 
The project, managed by NASA Johnson Space Center, seeks to develop an integrated Autonomous Guidance, 
Navigation, and Control (AGNC) hardware and software system capable of detecting and avoiding surface 
hazards and autonomously guiding a manned or unmanned space vehicle, to a safe touchdown within 90 meters 
of a pre-designated planetary or asteroid site [4]. 

The overarching problem statement for the ALHAT project is to “ Develop and mature to TRL (Technology 
Readiness Level) 6 an autonomous lunar landing GN&C and sensing system for crewed, cargo, and robotic 
lunar descent vehicles. The ALHAT System will be capable of identifying and avoiding surface hazards to 
enable a safe precision landing to within tens of meters of certified and designated landing sites anywhere on 
the Moon under any lighting conditions .” This problem statement allowed the ALHAT project to derive early 
in 2006 a set of high level requirements for the ALHAT System. These requirements, as shown in Table 1, have 
remained intact to date and have served as the primary reference set upon which all ALHAT System design is 
based [5]. 


Table 1: ALHAT System High Level Requirements 

R0.001 Landing Location - The ALHAT System shall enable landing of the vehicle at any 
surface location certified as feasible for landing. 

R0.002 Lighting Condition - The ALHAT System shall enable landing of the vehicle in any 
lighting condition. 

R0.003 Landing Precision - The ALHAT System shall enable landing of the vehicle at a 
designated landing point with a 1 sigma error of less than 30 meters TBR. 

R0.004 Hazard Detection and Avoidance - The ALHAT System shall detect hazards with a 
vertical height change of 30 cm TBR or more and detect slopes of 5 deg TBR and greater, and 
provide surface target redesignation based on detected hazards. 

R0.005 Vehicle Commonality - The ALHAT System shall enable landing of crewed, cargo, and 
robotic vehicles. 

R0.006 Operate Automatically - The ALHAT System shall have the capability to operate 
automatically. 

R0.007 Crew Supervisory Control - The ALHAT System shall accept supervisory control from 
the onboard crew. 

The overall ALHAT project flow is depicted in figure 2. Highlighted on the right are the two major deliverables 
of the project. The first being a detailed description of the ALHAT System architecture such that it can be 
adopted by NASA designers for future lunar landers. The second being the actual validation of that architecture 
via a series of field tests over the life span of the project. This gives the designers the confidence that the newly 
developed technologies will operate as expected in the relevant environment. 
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Fig. 2: ALHAT Project program flow 


3.ALHAT SYSTEM 

The ALHAT System under development by the ALHAT Project will use Terrain Relative Navigation (TRN) 
techniques to enable high-precision global navigation; will detect hazards at the landing site by utilizing an 
onboard Hazard Detection and Avoidance (HDA) sensor system; and will achieve high-precision local 
navigation using Hazard Relative Navigation (HRN) techniques. These TRN, HDA, and HRN capabilities 
operating in conjunction with the Autonomous Guidance, Navigation, and Control (AGNC) system will enable 
the next generation lunar lander vehicle (LLV) to land safely and precisely, independent from ground control, 
without lunar navigation infrastructure, and without a priori knowledge of a safe landing location. Further, the 
system will not be restricted by local lighting conditions, as was the case for Apollo. The design allows for 
crew interaction with the AGNC system so that the ALHAT system can support both robotic and crewed 
missions. The overall trajectory profile is a fundamental design parameter to the LLV system. The profile must 
be designed such that it provides a low AV solution to minimize consumed propellant mass during landing, 
while also accommodating the various other needs of the LLV. Some of these other needs are: terrain clearance 
during the deorbit and powered braking phases, dispersion correction margin for maneuver execution and 
navigation errors, and increased time and improved perspective of the landing site during the final approach 
when hazard avoidance maneuvers could occur. 



Fig. 3: Major Phases of Trajectory Descent for the ALHAT System 
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Figure 3 shows the major phases of a typical lunar descent trajectory from a parking orbit. For ALHAT, this 
initial orbit is assumed circular with a 100 km altitude. The deorbit burn begins the sequence of maneuvers 
necessary to land on the lunar surface. The deorbit burn targets a 100 x 15 km transfer orbit. The periapse of 15 
km was chosen to minimize propellant usage without exceeding safety margin needed for terrain clearance, as 
well as a passive abort in case of a failed Powered Descent Initiation (PDI). The deorbit burn is followed by a 
coast to PDI of about one hour duration. 
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The powered descent phase begins at PDI and continues until touchdown on the lunar surface. The engine 
remains on throughout this phase. Powered descent consists of 4 sub-phases: Braking, Pitch-up, Approach, and 
Terminal Descent. The objective of the braking maneuver is to remove the majority of the orbital velocity as 
efficiently as possible while targeting a certain altitude and range from the landing site. The timing of PDI (i.e. 
the start of the braking maneuver) is chosen so that the trajectory meets these target conditions efficiently given 
the vehicle’s thrust-to-weight ratio. During braking, the engine throttle remains at a high and relatively constant 
setting, and the vehicle is in a relatively horizontal orientation. During this maneuver, any trajectory dispersions 
due to burn execution errors or improved navigation state knowledge can be corrected. Errors in the along-track 
direction are mitigated by modulating the engine throttle, while cross-track errors are mitigated by directing the 
thrust out-of-plane to the trajectory [6]. 

The approach phase is purposely designed to have a more vertical attitude and lower acceleration level than the 
braking phase. The vertical attitude provides better visibility of the landing area, while the lower acceleration 
level provides for both slower speeds and more observation time while approaching the target. The intermediate 
pitch-up maneuver phase provides a smooth transition in acceleration level and vehicle attitude from the high 
thrust, near horizontal braking conditions to these desired approach conditions. By this point in the trajectory, 
the closed-loop Guidance & Control systems have corrected trajectory dispersions to the level of the Navigation 
system accuracy [6]. 

The objective of the final terminal descent maneuver is to descend slowly to the landing site in a near vertical 
orientation, staying directly over the landing target and nulling out any remaining horizontal velocity. At this 
point the landing target will likely no longer be visible to the crew and/or sensors onboard the vehicle. This is 
because the vehicle is descending directly from above the target, and lunar dust scattered from the engine 
exhaust will likely obscure the terrain below. Based on Apollo experience the terminal descent maneuver for 
ALHAT begins at 30m altitude [6]. 
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A functional block diagram of the ALHAT System in relationship to a host lunar landing vehicle is shown in 
Figure 4 in the context of a technology development testbed. For a crewed vehicle, the ALHAT System 
provides landing display data and accepts crew inputs. The figure also shows the overall relationship of the 
AGNC software with the other vehicle subsystems. 


4. ALHAT SYSTEM VALIDATION 

The ALHAT Project is responsible for the process of developing a system architecture, validated and verified to 
TRL 6, proposed for autonomous hazard detection and precision lunar landing. The TRL assessment objectives 
of the ALHAT Verification and Validation plan are to verify and validate that the ALHAT component 
technologies and the ALHAT System as a whole have reached a maturity level consistent with TRL 6 [7]. 

The achievement of TRL 6 is a primary goal of the 
ALHAT project in order to mature the technologies in 
time to allow future NASA projects to incorporate them 
into a future lunar lander design. It is recognized that the 
definition of TRL 6 is subject to interpretation, see figure 

5. For ALHAT purposes, the selection of TRL 6 exit 
criteria is guided by the objective of reducing risk to a 
level that a future lunar lander program could choose to 
baseline ALHAT technologies at Preliminary Design 
Review [7]. The project has set the ultimate goal to 
achieve “system prototype demonstration in a relevant 
environment” via autonomous closed loop precision 
landing and hazard detection demonstration on a 
terrestrial rocket. To meet that goal, the ALHAT project 
has undergone a series of field tests using various test 
vehicles and facilities to incrementally build the ALHAT 
System capability via component demonstration initially. 

Ultimately, the field testing culminates in a closed loop 
terrestrial rocket ALHAT System demonstration to 
achieve TRL 6. 

A. LAB TESTING 

The ALHAT AGNC algorithms which support this safe and precise lunar landing capability have been 
successfully tested in 6-DOF simulation (figure 6) for many varieties of reference trajectories, both in nominal 
conditions and under the influence of sensor and vehicle Monte Carlo perturbations. In these tests the ALHAT 
system has been shown to be robust to knowledge errors and trajectory dispersions and capable of performing 
autonomous hazard avoidance maneuvers. In these situations, the system global landing precision was on the 
order of 90 meters 3 -a with local (safe site relative) precision on the order of a few meters 3 -a across a variety 
of landing trajectory profiles. 
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Figure 5: Mankins TRL Levels and ALHAT 
Approach to Achieving them 



Fig. 6: Draper Laboratory ’s Lunar Landing Vehicle cockpit simulator 
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B. HELICOPTER TESTING 

The ALHAT Project Field Test 1 (FT1) was conducted in April 2008. This test flew a Flash LIDAR on a 
helicopter over a variety of natural and man-made targets. The purpose of the test was to assess the performance 
of Flash LIDAR technology and algorithms for Hazard Detection and Avoidance (HD A) and Hazard 
Relative Navigation (HRN) in an environment that was relevant to lunar landing, with a secondary objective of 
verifying the concept of the passive optical APLNav TRN methodology. The primary environmental variables 
investigated were ranges and angles relative to the target and hazard feature size [8]. 



Fig. 7: Initial ALHAT Field Test [9] 


To obtain a variety of slant ranges and path angles as well as descents toward the target a helicopter was used as 
the test platform. To obtain a variety of slant ranges and path angles as well as descents toward the target a 
helicopter was used as the test platform. Figure 7 shows an example test flight path over Dryden. An inertially 
stabilized gimbal was mounted to the front of the helicopter. The gimbal contained the Flash LIDAR, two 
Inertial Measurement and an analog camera. A Global Positioning System (GPS) antenna was attached on the 
fixed structure above the gimbal. To verify the concept of APLNav TRN, visible cameras were mounted to the 
helicopter to capture terrain images as the helicopter flew to, from, and around the HD A target areas. The 
visible camera images, along with IMU and GPS data, were collated and used as input to the APLNav algorithm 
for post-processing [8]. 

The FT1 analysis first assessed the flash lidar in terms of its sensitivity (pixel trigger fraction) and range 
measurement precision as a function of path angle and slant range. The results show that the lidar has a worst 
case range error (random noise) of 0.20m one sigma. When imaging though the gimbal window (28% loss), the 
lidar has a maximum range between 400m for nadir viewing and 250m for oblique viewing (15° from 
horizontal). These results are for dry lakebed material that does not necessarily have the same reflectivity as the 
lunar surface [9]. 

The data collected during FT2 proved to be highly valuable in demonstrating the capabilities of the Doppler 
LIDAR, and also served as a tool to test and develop signal processing and analysis algorithms. Analysis of the 
data showed velocity measurements in excellent agreement with the high accuracy GPS derived velocities. 
Ground relative altitude and attitude measurements were also demonstrated. The successful flight test of this 
Doppler LIDAR sensor established it at a TRL of 4 [8]. 

The next ALHAT field test, FT4, completed in July 2010, had four primary objectives. The first objective was 
to demonstrate the application of an integrated, real-time GN&C system (derived from a lunar lander 
implementation) for Earth-based flight testing over a range of vehicle approach conditions consistent with the 
ALHAT simulation studies to date. The second objective was to demonstrate precision pointing of the gimbaled 
flash lidar using real-time GN&C data (position, velocity attitude, and attitude rates) in combination with the 
gimbal manager and mapper components of the TSAR software. The third objective was to characterize the 
performance of second generation ALHAT sensors - Flash LIDAR, Doppler LIDAR, and laser altimeter - 
along with accessories such as Flash LIDAR zoom optics. The last objective was to demonstrate the ability to 
utilize the recorded ALHAT sensor data to generate a 3-D terrain map and perform the hazard detection, landing 
aim point selection, and local relative navigation functions required for an autonomous safe precision landing. 
The FT4 instrument suite includes four distinct sensor subsystems: two Flash LIDARs, a three-beam Doppler 
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LIDAR velocimeter, and a laser altimeter. All of the sensors and support equipment were housed in an external 
pod attached to the bottom of the helicopter. The two Flash LIDARs are mounted on a shared gimbal 
mechanism [8]. {Erik — need to find JPL reference that speaks of FT-4 results here} [9,10] 


C. AIRCRAFT TESTING 

To verify TRN performance in a moon-like environment, the Applied Physics Laboratory (APL), NASA 
Langley Research Center (LaRC) and the Jet Propulsion Laboratory (JPL), prepared two prototype TRN 
systems for use in an ALHAT sponsored field test conducted 20 June 2009 to 7 July 2009 over the Nevada Test 
Site (NTS), Nevada and Death Valley National Park (DVNP), California. Both TRN instruments used a King 
Air B200 aircraft equipped with four digital cameras, laser altimeter, and flash lidar to image well surveyed 
landscapes at various altitudes, under specific lighting conditions. In addition to the TRN instruments, other test 
equipment and sensors were flown during FT3 to provide a truth system to score the TRN results. Several GPS 
receivers were used, sharing a single GPS antenna, and multiple INS were employed so that each sensor had a 
primary and a backup position and attitude sensor suite. The camera configuration on the test airplane is shown 
in Fig. 8. In addition to the optical camera, the aircraft carried a LaRC built laser altimeter that used a JPL 
developed algorithm to do elevation correlation to estimate position [11]. 



Fig. 8: TRN Optical Camera Configuration on ALHAT Field Test Airplane [10] 

The field test clearly shows that both TRN algorithms will achieve the 90m ALHAT landing accuracy 
requirement. The airplane flight tests of the APLNav TRN algorithm successfully demonstrated that robust and 
accurate three dimensional position estimates can be generated using passive optical sensors [CRISS:6]. In both 
cases, TRN estimates have errors typically less than 50m, strongly driven by the quality and resolution of the 
reference digital elevation maps (DEM) [12,13]. 

D. TERRESTRIAL ROCKET TESTING 

NASA has envisioned a suite of lander test vehicles that will be flown in Earth’s atmosphere to incrementally 
demonstrate applicable lunar lander performance in the terrestrial environment. As each terrestrial rocket 
progresses in maturity, relevant space flight technology matures to a higher technology readiness level, 
preparing it for inclusion on a future lunar lander design [14]. 

The Draper Laboratory built GENIE (Guidance Embedded Navigator Integration Environment) successfully 
demonstrated accurate, real time, embedded performance of ALHAT navigation and guidance algorithms in a 
highly dynamic environment. The RR1 vehicle, built by Armadillo Aerospace, performed a successful 60 
second free flight and gave the team great confidence in ALHAT ’s highly reliable and robust GNC system 
design and implementation. The GENIE was conceptualized in January 2010 to be an extensible platform 
capable of validating an assortment of navigation and guidance algorithms via simple software load for a variety 
of users. The integrated hardware and software platform was built to flight worthy completion within seven 
weeks via rapid prototyping effort at Draper Laboratory [14]. 
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Fig. 9: June 2010 RR-1 GENIE flight test in Caddo Mills, Texas USA [14] 

Since the successful flight of GENIE in June 2010 (figure 9) on the Armadillo Pixel vehicle, a significant effort 
has focused on applying the extensible system to demonstrate closed loop control on at least two independent 
terrestrial rockets. The first is a NASA Johnson Space Center developed, Armadillo Aerospace derived, 
terrestrial rocket known as Morpheus. Fundamentally Morpheus is a larger and more capable Pixel vehicle to 
be used as a general testbed, including validation of ALHAT approach phase trajectory execution. The second 
is a Masten Aerospace terrestrial rocket capable of both ALHAT approach phase trajectories and Martian 
approach phase trajectories. The Armadillo Aerospace Pixel, Masten Aerospace Xombie, and JSC Morpheus 
vehicle are pictured in Figure 10, are the basis for future NASA derived GENIE customized vehicles that allow 
full closed loop control to best validate a host of applicable space landing technologies [14]. 

Both GENIE enabled vehicles will incrementally raise associated technology readiness levels of suitable lunar 
and martian next generation technologies through closed loop payload testing. Potential payloads include 
ALHAT derived velocimeters, altimeters, terrain relative navigation sensors, hazard detections systems, and 
associated algorithms applicable to the Moon, Mars, or Near Earth asteroids. As each system progresses in 
maturity through repeated terrestrial flight, the desire is that the now TRL 6 advanced technology will be more 
readily adopted in future near term space missions, giving the spacecraft designer more capability and 
technology options to choose from [14]. 



Fig. 10: Aerospace Pixel (left), Masten Xombie (center), and JSC Morpheus (right) Terrestrial Rockets 


E. C. UPCOMING VALIDATION PLANS 

In the 2013 timeframe, GENIE AGNC software aims to autonomously fly a terrestrial rocket by determining 
vehicle navigation state and calculating the when, where, and how to control the vehicle and to land using an 
ALHAT hazard detection system to help identify safe landing locales in the local terrain. Known as the 
“Precision Landing Demo”, a full suite of AGNC sensors including an optical camera based TRN sensor, a laser 
altimeter, and a Doppler radar will demonstrate a closed loop precision landing at significant downrange 
distances (2-5km) from the initial takeoff pad. Additionally during the representative approach phase of the 
flight an onboard ALHAT hazard detection system will carefully detect prepositioned hazards at the landing site 
allowing onboard AGNC to automatically pick a safe landing location and subsequently guide the vehicle to 
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that safe locale while avoiding hazards. Referred to as the “Hazard Detection Demo”, this demonstration can be 
combined within the same GENIE enabled terrestrial rocket validation flight after successful independent 
demonstration on the Morpheus vehicle. The successful completion of these two demonstrations (shown in 
figure 11), preferably in a single flight, will raise the TRL to 6 for the ALHAT System, completing the primary 
project mission statement set forth by the project in 2005. 
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Fig . 11: Planned demonstration flights of the ALHAT System in 2012-2013 timeframe 


5.CONCLUSION 

The ALHAT System will enable safe and precise landing for the next generation lunar lander vehicles. The 
overall validation of the ALHAT System is necessary to prove that the highly integrated hardware and software 
components work together in concert to achieve 100m precision landings in hazardous locations, under any 
lighting condition. To accomplish this, a series of field tests over the past few years has occurred testing various 
key components of the ALHAT System. A final integrated validation campaign has begun that is using a 
commercially derived terrestrial rocket platform to demonstrate the ALHAT System capability. Once 
completed in the 2012-2013 timeframe, the ALHAT System will have raised its TRL to 6, successfully bridging 
the TRL 5-6 “valley of death” so common to technology development programs. 

At TRL 6, the ALHAT System is more likely to be adopted by future spacecraft landing designers since 
successful validation will have occurred through integrated demonstration of the system in a relevant 
environment. Future spacecraft designers will then better understand demonstrated capabilities of the prototype 
ALHAT System allowing them to more easily integrate the highly autonomous landing capability into the next 
generation lander baseline at inception. 

In order to validate the ALHAT System, the ALHAT project will have committed significant resources to best 
develop a capability for a terrestrial rocket to fly lunar and/or mars like trajectories. The payload capable 
terrestrial rocket will be able to travel at high speeds significantly downrange in a safe and controlled manner. 
This ALHAT derived capability will mark a significant capability for NASA in that a terrestrial based lander 
will be able to raise the technology readiness level of other EDL flyable payloads intended for the Moon or 
Mars, not just the ALHAT System. Various EDL type sensors and payloads stand to benefit by having a 
validation mechanism to raise their TRL of their system, comparing ALHAT AGNC truth data to their own, and 
subjecting their payloads to a relevant trajectory environment here on Earth. 
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